Setting VIT/VUL to Closed/Deferred

[Khanna Ji]

Hi SecOps experts,

I was just thinking if I set VIT/VUL to Closed/Deferred and if that vulnerability state changes to fixed in Qualys, does that change the state in ServiceNow to closed or fixed or will it be ignored?

Wondering how state changes are handled between ServiceNow and Qualys. 

My understanding is - All VITs will be marked as closed irrespective of the state in ServiceNow once it gets updated as fixed in Qualys

[Chris McDevitt]

Well... after re-reading the PRB and looking at the OOB code and what the article said vs what it showed... I think there is a typo in the PRB:

[Khanna Ji]

Did you make this change sir? I am still afraid to make the changes. We are not imported fixed vulnerabilities though.

Are you able to see VITs getting closed when they are fixed in Qualys? If so then I don't think this change is needed.

[Chris McDevitt]

Swathi,

No, I did not make that change. But... It has me wondering. 

[Khanna Ji]

Maybe we should report this to Hi. Don't know if they are following this space.

[sukku]

Hi Chris,

Hope you are doing well!

I have seen your post in GitHub on

QualysHostImportReportProcessor_handleVulnerableItem.js

From Qualys we are getting this type data whether it is confirmed or potential vulnerabilities in xml. But we need to add this data either to vulnerability or item table.

I have gone through this script include which you have mentioned in above post. But I could not find handleVulnerableItem function at all. I have even gone through other host detection script includes also.

We are in Orlando version. Could you please guide me where exactly we need to modify the script inorder to capture this data. Since these are all connector I am bit afraid to change the oob script includes as it might effect on other integrations to play around.

Thanks and Regards,

Sukanya